CVE-2026-11997: Bulk SEO Image Plugin CSRF Vulnerability

CVE-2026-11997 Overview

CVE-2026-11997 is a Cross-Site Request Forgery (CSRF) vulnerability in the Bulk SEO Image plugin for WordPress, affecting all versions up to and including 1.1. The flaw resides in the BulkSeoImage() settings page handler, which dispatches to launchbulk() and BulkSeoImageGo() when a request contains $_POST['bulkseoimage']. The plugin omits wp_nonce_field() from its form and skips check_admin_referer() or wp_verify_nonce() validation. Unauthenticated attackers can trick a logged-in administrator into submitting a forged request that bulk-overwrites the _wp_attachment_image_alt post meta for every image attached to published posts and pages. The issue is tracked under [CWE-352].

Critical Impact
A successful CSRF attack lets an unauthenticated attacker overwrite ALT-text metadata for every image on every published post and page, degrading SEO and accessibility site-wide.

Affected Products

Bulk SEO Image plugin for WordPress, versions up to and including 1.1

Discovery Timeline

2026-06-24 - CVE-2026-11997 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-11997

Vulnerability Analysis

The Bulk SEO Image plugin exposes an administrative bulk-update workflow without CSRF protections. When an authenticated administrator loads the plugin's settings page, the form that triggers the bulk ALT-text rewrite does not emit a nonce. The server-side handler accepts the POST request based solely on the presence of the bulkseoimage parameter and the administrator's session cookie. Browsers automatically attach session cookies to cross-origin requests, so any page an administrator visits can issue the state-changing POST on their behalf. The handler then iterates over published posts and pages, fetches attached image IDs, and overwrites _wp_attachment_image_alt for each attachment with attacker-supplied content.

Root Cause

The root cause is missing CSRF token generation and validation in the plugin's settings workflow. WordPress provides wp_nonce_field() for token emission and check_admin_referer() or wp_verify_nonce() for verification. Neither is used in the vulnerable code paths at bulk-seo-image.php lines 11, 76, and 147. Without a per-request nonce, the handler cannot distinguish a legitimate administrator submission from a forged cross-origin request.

Attack Vector

Exploitation requires user interaction from a privileged administrator. An attacker hosts a page containing an auto-submitting HTML form or JavaScript fetch that targets the plugin's admin endpoint with the bulkseoimage POST parameter and the desired ALT-text payload. The attacker then delivers the link via phishing, comments, or a compromised site. When the administrator loads the page while authenticated to WordPress, the browser submits the request with valid session cookies, and the plugin executes the bulk overwrite across the entire site's image library tied to published content.

No proof-of-concept code is published. Refer to the Wordfence Vulnerability Report and the WordPress Plugin Source Code for the vulnerable handler.

Detection Methods for CVE-2026-11997

Indicators of Compromise

Unexpected, uniform values across _wp_attachment_image_alt post meta for many attachments, often updated within a narrow timeframe.
WordPress access logs showing POST requests to the plugin's admin page containing the bulkseoimage parameter from a referrer outside the WordPress admin domain.
Administrator browser history showing visits to untrusted pages immediately preceding the bulk meta update.

Detection Strategies

Query the wp_postmeta table for rows where meta_key = '_wp_attachment_image_alt' and compare current values against backups or revisions to identify mass overwrites.
Inspect web server access logs for POST requests to wp-admin pages containing bulkseoimage with Referer headers pointing to external origins.
Enable WordPress audit logging plugins to track post meta changes and administrator-initiated plugin actions.

Monitoring Recommendations

Alert on bulk modifications to attachment metadata occurring outside scheduled content workflows.
Monitor administrator sessions for cross-origin POST submissions to /wp-admin/admin.php endpoints associated with the Bulk SEO Image plugin.
Track plugin version inventory and flag any WordPress site still running Bulk SEO Image 1.1 or earlier.

How to Mitigate CVE-2026-11997

Immediate Actions Required

Deactivate and remove the Bulk SEO Image plugin until a patched version is released by the vendor.
Audit _wp_attachment_image_alt values across all published posts and pages and restore legitimate ALT text from backups where overwrites are found.
Instruct administrators to log out of WordPress sessions before browsing untrusted sites and to use a dedicated browser profile for admin tasks.

Patch Information

No fixed version is listed in the available references at the time of publication. Monitor the Wordfence Vulnerability Report and the plugin's WordPress.org page for an updated release that adds wp_nonce_field() emission and check_admin_referer() validation to the BulkSeoImage() handler.

Workarounds

Remove the plugin entirely if a bulk ALT-text workflow is not actively required.
Restrict access to /wp-admin/ using IP allow-listing or a web application firewall rule that blocks POST requests containing bulkseoimage from external referrers.
Apply a WAF signature that rejects state-changing WordPress admin requests lacking a valid _wpnonce parameter.

bash

# Example WAF rule (ModSecurity) blocking cross-origin POSTs to the vulnerable handler
SecRule REQUEST_METHOD "@streq POST" \
  "chain,id:1029997,phase:2,deny,status:403,msg:'CVE-2026-11997 Bulk SEO Image CSRF'"
  SecRule ARGS_POST_NAMES "@streq bulkseoimage" "chain"
    SecRule REQUEST_HEADERS:Referer "!@beginsWith https://your-site.example/wp-admin/"